Changeset 1601 for trunk

Timestamp:

Aug 21, 2010, 4:03:13 AM (14 years ago)

Author:

geofft

Message:

admof: Re-resolve the potential sysadmin's name within SYSADMIN_CELL

While it's true that foreign cells will generally resolve the username to e.g.
geofft.root@athena.mit.edu, which the athena cell ptservers are okay with, it's
more correct to just use the name as resolved in the athena cell.

File:

• trunk/server/common/oursrc/accountadm/admof.c (modified) (3 diffs)

trunk/server/common/oursrc/accountadm/admof.c

@@ -96 +96 @@
 }
 
+/* Resolve a Kerberos principal to a name usable by the AFS PTS. */
+void
+resolve_principal(const char *name, const char *cell, char *user)
+{
+    /* Figure out the cell's realm. */
+    krb5_context context;
+    krb5_init_context(&context);
+
+    char **realm_list;
+    if (krb5_get_host_realm(context, cell, &realm_list) != 0 ||
+        realm_list[0] == NULL)
+        die("internal error: krb5_get_host_realm failed");
+
+    /* Convert the Kerberos 5 principal into a (Kerberos IV-style) AFS
+       name, omitting the realm if it equals the cell's realm. */
+    krb5_principal principal;
+    if (krb5_parse_name(context, name, &principal) != 0)
+        die("internal error: krb5_parse_name failed");
+    char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
+    if (krb5_524_conv_principal(context, principal, pname, pinst, prealm) != 0)
+        die("internal error: krb5_524_conv_principal failed\n");
+    if (kname_unparse(user, pname, pinst,
+                      strcmp(prealm, realm_list[0]) == 0 ? NULL : prealm) != 0)
+        die("internal error: kname_unparse failed\n");
+
+    krb5_free_principal(context, principal);
+    krb5_free_host_realm(context, realm_list);
+    krb5_free_context(context);
+
+    /* Instead of canonicalizing the name as below, we just use
+       strcasecmp above. */
+#if 0
+    afs_int32 id;
+    if (pr_SNameToId((char *)user, &id) != 0)
+        die("bad principal\n");
+    if (id == ANONYMOUSID)
+        die("anonymous\n");
+    if (pr_SIdToName(id, user) != 0)
+        die("internal error: pr_SIdToName failed\n");
+#endif
+}
+
 int
 main(int argc, const char *argv[])
@@ -186 +228 @@
     afsconf_Close(configdir);
 
-    /* Figure out the cell's realm. */
-    krb5_context context;
-    krb5_init_context(&context);
-
-    char **realm_list;
-    if (krb5_get_host_realm(context, cellconfig.hostName[0], &realm_list) != 0 ||
-        realm_list[0] == NULL)
-        die("internal error: krb5_get_host_realm failed");
-
-    /* Convert the Kerberos 5 principal into a (Kerberos IV-style) AFS
-       name, omitting the realm if it equals the cell's realm. */
-    krb5_principal principal;
-    if (krb5_parse_name(context, name, &principal) != 0)
-        die("internal error: krb5_parse_name failed");
-    char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
-    if (krb5_524_conv_principal(context, principal, pname, pinst, prealm) != 0)
-        die("internal error: krb5_524_conv_principal failed\n");
     char user[MAX(PR_MAXNAMELEN, MAX_K_NAME_SZ)];
-    if (kname_unparse(user, pname, pinst,
-                      strcmp(prealm, realm_list[0]) == 0 ? NULL : prealm) != 0)
-        die("internal error: kname_unparse failed\n");
-
-    krb5_free_principal(context, principal);
-    krb5_free_host_realm(context, realm_list);
-    krb5_free_context(context);
-
-    /* Instead of canonicalizing the name as below, we just use
-       strcasecmp above. */
-#if 0
-    afs_int32 id;
-    if (pr_SNameToId((char *)user, &id) != 0)
-        die("bad principal\n");
-    if (id == ANONYMOUSID)
-        die("anonymous\n");
-    if (pr_SIdToName(id, user) != 0)
-        die("internal error: pr_SIdToName failed\n");
-#endif
+    resolve_principal(name, cellconfig.hostName[0], user);
 
     /* Read the locker ACL. */
@@ -250 +257 @@
         char sysadmins[] = SYSADMINS, sysadmin_cell[] = SYSADMIN_CELL;
         if (pr_Initialize(secLevel, (char *)AFSDIR_CLIENT_ETC_DIRPATH, sysadmin_cell) == 0) {
+            resolve_principal(name, sysadmin_cell, user);
             if (ismember(user, sysadmins)) {
                 openlog("admof", 0, LOG_AUTHPRIV);